[SOLVED] Forum been hacked, help pls ASAP?

[creativeconceptdesigner]

My friend uses phpBB for a popular pregnancy forum - Its been hacked so hope you can help us sort it.

There is a really terrible picture on there of a dead baby cut open - it's only on the forum index, it isn't on any of the other forum pages.

Whilst on the forum index I viewed the source code and found this:-

<div style="position:absolute;top:0;left:0;width:100%;h eight:10000px;background:#000;color:#C32;font-family:Verdana;font-size:24px;padding-top:20%;text-align:center;">owned by copypasta<br><img src="removed"></div>

<object data="removed" type="audio/mpeg" height="0" width="0"><param name="autostart" value="true"><param name="loop" value="true"><param name="hidden" value="true"></object>
<bgsound src="removed" loop="-1" volume="0" autostart="true" hidden="true"><br />

Please can anybody tell me which file we need to edit to remove this code? At the moment, the forum is disabled so that nobody has to view this picture.

Please help! Thank you so much.

[Marc]

Do you have access to the MySQL Database or whatever it is running on?

[Daniel]

You don't need the database... That will probably be in the overall_header.php or overall_footer.php template.

[creativeconceptdesigner]

Yes my friend does hope you can help!

[Marc]

He cant log in though... He can do that if he has FTP access, yes.. But he also will want to log in...

Ill let Dan take this further, i dont know anything else about PHPBB, I am a vBulletin person myself

[Daniel]

the admin password has been reset - he can log in. Remove the code through your FTP access or through the admin control panel.

[alexgeek]

Marc he can log in, he just said they reset the password.
It shames that I'm pretty sure who did this..

[Marc]

LOL I read it wrong... It will be in the overall_header or overall_footer like Dan said then.

[Daniel]

Just find it and remove that image - its horrible *is sick*

[creativeconceptdesigner]

ok so she needs to look for overall_footer.php & overall_header.php?

[creativeconceptdesigner]

Yep it certainly is twisted! Its gross!

[Daniel]

where abouts on the site is the image situated? Is it at the top or at the bottom?

[Daniel]

Originally Posted by creativeconceptdesigner

Yep it certainly is twisted! Its gross!

I was stupid enough to click that link

[creativeconceptdesigner]

OK its not in the overall_footer.php or overall_header.php templates.......

[Daniel]

what version of phpbb are you running on?

[creativeconceptdesigner]

it's on 2.0.20

[Daniel]

Ok. PM.

[creativeconceptdesigner]

alexgeek who did this?

[creativeconceptdesigner]

OK we are trying a new skin to see if that works, is there anything else anyone can suggest we try if this doesnt work?

[Daniel]

uppgrade